CVE-2024-47270: Synology Surveillance Station Vulnerability

CVE-2024-47270 Overview

CVE-2024-47270 is an improper preservation of permissions vulnerability [CWE-281] in the Archiving Push functionality of Synology Surveillance Station. The flaw affects versions prior to 9.2.2-11575 and 9.2.2-9575. Remote authenticated users holding administrator privileges can perform limited file writes through unspecified vectors. Synology documented the issue in Synology Security Advisory SA-24-25. The vulnerability requires high privileges and does not affect confidentiality or availability, which constrains its practical impact to integrity tampering within the application context.

Critical Impact

Authenticated administrators can write to files outside the intended scope of the Archiving Push feature, enabling limited tampering of application data on affected Surveillance Station deployments.

Affected Products

• Synology Surveillance Station versions before 9.2.2-11575
• Synology Surveillance Station versions before 9.2.2-9575
• Synology DiskStation Manager (DSM) deployments running vulnerable Surveillance Station packages

Discovery Timeline

• 2026-05-27 - CVE-2024-47270 published to the National Vulnerability Database
• 2026-05-27 - Last updated in the NVD database

Technical Details for CVE-2024-47270

Vulnerability Analysis

The vulnerability resides in the Archiving Push functionality of Synology Surveillance Station. The component does not correctly preserve file permissions when processing archive push operations. As a result, the application writes files in a manner that diverges from the intended permission model. An authenticated administrator can leverage this behavior to perform limited file write operations through unspecified vectors documented by Synology. The defect is classified under [CWE-281: Improper Preservation of Permissions]. Exploitation requires valid administrator credentials and network reachability to the Surveillance Station service. The EPSS estimate places the probability of observed exploitation activity at a very low level.

Root Cause

The Archiving Push routine fails to apply or retain the correct permission set when writing destination files. Synology has not published the specific code path. The behavior aligns with classes of bugs where permission inheritance, umask handling, or explicit chmod calls are missing after file creation. The result is that file write operations execute outside the constrained permission boundary the feature should enforce.

Attack Vector

An attacker authenticates to Surveillance Station with administrator privileges over the network. The attacker then invokes the Archiving Push functionality using crafted parameters to trigger a write operation. Because permissions are not preserved correctly, the resulting file is written with weaker constraints than intended, producing a limited integrity impact. No user interaction is required, and the scope remains unchanged. Confidentiality and availability are not directly affected by the flaw.

No public proof-of-concept code is available. Refer to the Synology Security Advisory SA-24-25 for vendor-supplied technical details.

Detection Methods for CVE-2024-47270

Indicators of Compromise

• Unexpected files written by the Surveillance Station service account in directories associated with archive operations
• Files with permission bits that diverge from baseline Surveillance Station file ownership and mode patterns
• Administrator account activity invoking Archiving Push outside of normal operational windows

Detection Strategies

• Audit Surveillance Station logs for Archiving Push invocations correlated with administrator session activity
• Compare file permission baselines on Surveillance Station storage volumes against current state to identify drift
• Monitor DSM administrative authentication events for anomalous administrator logons that precede archive operations

Monitoring Recommendations

• Forward DSM and Surveillance Station logs to a centralized log platform for retention and correlation
• Alert on changes to file permissions within directories owned by the Surveillance Station service
• Track creation of new administrator accounts on DSM appliances hosting Surveillance Station

How to Mitigate CVE-2024-47270

Immediate Actions Required

• Upgrade Synology Surveillance Station to version 9.2.2-11575 or 9.2.2-9575 or later as specified in the vendor advisory
• Restrict administrator account membership to the minimum set of operators required to manage Surveillance Station
• Enforce multi-factor authentication on all DSM administrator accounts to limit credential misuse

Patch Information

Synology has released fixed packages. Update Surveillance Station to 9.2.2-11575 or 9.2.2-9575 or later through DSM Package Center. Review the Synology Security Advisory SA-24-25 for the authoritative list of fixed builds and applicable DSM versions.

Workarounds

• No vendor-supplied workaround is documented. Apply the patched Surveillance Station package as the primary remediation
• Limit network exposure of the Surveillance Station management interface to trusted administrative networks until patching completes
• Rotate administrator credentials after patching if there is suspicion that the flaw was abused prior to remediation

# Verify installed Surveillance Station version on DSM via SSH
synopkg version SurveillanceStation

# Trigger a package update check from the CLI
synopkg checkupdateall